ASEAN Checklist for the Implementation of the Norms of Responsible State Behaviour in Cyberspace - Introduction - Using the Checklist - Norm 13 (a)

Sep 20, 2026

ASEAN’s checklist provides actionable steps for States to consider when implementing the UN norms of responsible State behaviour in cyberspace. It explains that the 11 voluntary, non-binding norms set out what States should and should not do, and that the Norms Implementation Checklist translates them into practical measures across policy, operational, technical, legal, and diplomacy pillars. The document outlines how each norm is presented through sample tables, including suggested agencies, steps, and capacity-building activities.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages40

Reading Time1 h 41 min

AccessFree to download

Introduction

Using the Checklist

Norm 13 (a)

ASEAN Checklist for the Implementation of the Norms of Responsible State Behaviour in Cyberspace Acknowledgments ASEAN Member States would like to acknowledge the support provided by the UN Office for Disarmament Affairs (UNODA) in the development of the ASEAN Checklist forthe implementation of the Norms of Responsible State Behaviour in Cyberspace and the Security and Technology Programme at the United Nations Institute for Disarmament Research (UNIDIR) for the finalization of it. Contents Introduction Using the Checklist Norm 13 (a) Norm 13 (b) Norm 13 (c) Norm 13 (d) Norm 13 (e) Norm 13 (f) Norm 13 (g) Norm 13 (h) Norm 13 (i) Norm 13 (j) Norm 13 (k) 3 4 5 8 11 14 17 19 22 26 29 33 37 Introduction The 11 voluntary, non-binding norms of responsible State behaviour in cyberspace were first agreed upon by the 2015 United Nations group-of-governmental experts in 2015, and subsequently endorsed by consensus at the General Assembly in 2015 through resolution 70/237. In 2018, ASEAN ministers responsible for cybersecurity subscribed in principle to the 11 cyber norms, and expressed ASEAN’s commitment to operationalize the norms to promote regional stability in cyberspace. The 11 cyber norms were also reaffirmed atthe Open-ended Working Group (OEWG) on security of and in the use of information and communications technologies 2019–2021, and 2021–2025. While the 11 norms outline the broad principles of responsible behaviour in cyberspace through high-level statements, the Norms Implementation Checklist (NIC) provides a set of actions that all States can consider and follow to implement the United Nations norms of responsible State behaviour in cyberspace. These 11 voluntary and non-binding norms describe what a State should and should not do in the cyberspace. This Checklist aims to provide actionable steps for all States to consider, including small States with limited capacities. States do not need to implement all steps in the checklist, but to consider the suggested steps in line with their respective national priorities and capacities. It is hoped that with these norms implemented, States will have a common understanding of what to expect from each other, thereby supporting international peace and security in cyberspace. 3 Using the Checklist Each of the 11 norms and their actionable items will be displayed in the sample table format shown below. | Norm 13(x) Sample Norm Name
Full agreed text of norm | | | | --- | --- | --- | | PILLARS | VOLUNTARY STEPS TO
BE CONSIDERED | SUGGESTED CAPACITY-BUILDING ACTIVITIES | | Pillar name | Detailed and actionable items on how the relevant government agencies can consider implementing the norm. | Possible capacity-building activities States can consider doing to meet the norm. | Within each norm, the items will be separated into five pillars: policy, operational, technical, legal, and diplomacy. This is to provide greater clarity on how different State agencies can contribute to these cyber norms. Meaningful implementation of the 11 cyber norms requires the involvement of multiple stakeholders and a whole-of-government approach. States may wish to consider setting up an inter-agency process to coordinate these discussions. The following gives more details of each pillar: | PILLAR NAME | SUGGESTED STATE AGENCIES TO REVIEW THE PILLAR | DESCRIPTION OF THE PILLAR | | --- | --- | --- | | Policy | • Policy divisions in agencies in charge of cybersecurity | Suggests steps to take to set the direction and expectations a State has in mind for the norms. | | Operational | • IT divisions in agencies in charge of cybersecurity
• National CERTs/CSIRTs | Suggestsstepstotakethatconcernsday-to-day cyber-related State activities as well as cyber incident response. | | Technical | • Technical divisions in agencies in charge of cybersecurity
• IT divisions in agencies in charge of cybersecurity | Suggests steps to take t

FAQs

What is the purpose of the ASEAN Norms Implementation Checklist (NIC)?

It provides a set of actions States can consider to implement the UN norms of responsible State behaviour in cyberspace, including for States with limited capacities.

Are the 11 cyber norms legally binding?

No. The norms are described as voluntary and non-binding, and States are not required to implement all steps listed in the checklist.

How is the checklist structured within each norm?

Each norm is organized into five pillars—policy, operational, technical, legal, and diplomacy—using a sample table format that specifies steps and suggested capacity-building activities.

Sep 20, 2026

Uploaded by Guten tag